Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix extmark docs #3

Closed
wants to merge 3 commits into from
Closed

Fix extmark docs #3

wants to merge 3 commits into from

Conversation

norcalli
Copy link

No description provided.

@justinmk
Copy link
Owner

thanks, added to neovim#11378

@justinmk justinmk closed this Nov 16, 2019
justinmk added a commit that referenced this pull request May 28, 2022
@justinmk
fix(startup): crash on early logging
074c1dc 
Problem:
22b52dd (neovim#11501) regressed 6f27f5e (neovim#10172), because
set_init_1..process_spawn tries to log (see backtrace below), but the
mutex isn't initalized yet. Even if the mutex were valid, we don't want
early logging to fallback to stderr because that can break embedders
when stdio is used as an RPC channel.

Solution:
- Skip logging if log_init wasn't called yet.
- FUTURE: when "remote TUI" is merged, can we remove log_lock()?

    frame #1: 0x00000001001d54f4 nvim`open_log_file at log.c:205:7
    frame #2: 0x00000001001d5390 nvim`logmsg(log_level=1, context="UI: ", func_name=0x0000000000000000, line_num=-1, eol=true, fmt="win_viewport") at log.c:150:20
    frame #3: 0x000000010039aea2 nvim`ui_call_win_viewport(grid=2, win=1000, topline=0, botline=1, curline=0, curcol=0, line_count=1) at ui_events_call.generated.h:321:3
    frame #4: 0x00000001003dfefc nvim`ui_ext_win_viewport(wp=0x0000000101816400) at window.c:939:5
    frame #5: 0x00000001003ec5b4 nvim`win_ui_flush at window.c:7303:7
    frame #6: 0x00000001003a04c0 nvim`ui_flush at ui.c:508:3
    frame neovim#7: 0x00000001002966ba nvim`do_os_system(argv=0x0000600000c0c000, input=0x0000000000000000, len=0, output=0x0000000000000000, nread=0x00007ff7bfefe830, silent=false, forward_output=false) at shell.c:894:3
    frame neovim#8: 0x0000000100295f68 nvim`os_call_shell(cmd="unset nonomatch; vimglob() { while [ $# -ge 1 ]; do echo \"$1\"; shift; done }; vimglob >/var/folders/gk/3tttv_md06987tlwpyp62jrw0000gn/T/nvimwwvwfD/0 ~foo", opts=kShellOptExpand | kShellOptSilent | kShellOptHideMess, extra_args=0x0000000000000000) at shell.c:663:18
    frame neovim#9: 0x0000000100295845 nvim`call_shell(cmd="unset nonomatch; vimglob() { while [ $# -ge 1 ]; do echo \"$1\"; shift; done }; vimglob >/var/folders/gk/3tttv_md06987tlwpyp62jrw0000gn/T/nvimwwvwfD/0 ~foo", opts=kShellOptExpand | kShellOptSilent | kShellOptHideMess, extra_shell_arg=0x0000000000000000) at shell.c:712:14
    frame neovim#10: 0x0000000100294c6f nvim`os_expand_wildcards(num_pat=1, pat=0x00007ff7bfefeb20, num_file=0x00007ff7bfefee58, file=0x00007ff7bfefee60, flags=43) at shell.c:328:7
    ...
    frame neovim#23: 0x000000010028ccef nvim`expand_env_esc(srcp=",~foo", dst="~foo", dstlen=4094, esc=false, one=false, prefix=0x0000000000000000) at env.c:673:17
    frame neovim#24: 0x000000010026fdd5 nvim`option_expand(opt_idx=29, val=",~foo") at option.c:1950:3
    frame neovim#25: 0x000000010026f129 nvim`set_init_1(clean_arg=false) at option.c:558:19
    frame neovim#26: 0x00000001001ea25e nvim`early_init(paramp=0x00007ff7bfeff5f0) at main.c:198:3
    frame neovim#27: 0x00000001001ea6bf nvim`main(argc=1, argv=0x00007ff7bfeff848) at main.c:255:3
justinmk added a commit that referenced this pull request May 28, 2022
@justinmk
fix(startup): crash on early logging
86debd1 
Problem:
22b52dd (neovim#11501) regressed 6f27f5e (neovim#10172), because
set_init_1..process_spawn tries to log (see backtrace below), but the
mutex isn't initalized yet. Even if the mutex were valid, we don't want
early logging to fallback to stderr because that can break embedders
when stdio is used as an RPC channel.

Solution:
- Skip logging if log_init wasn't called yet.
- FUTURE: when "remote TUI" is merged, can we remove log_lock()?

    frame #1: 0x00000001001d54f4 nvim`open_log_file at log.c:205:7
    frame #2: 0x00000001001d5390 nvim`logmsg(log_level=1, context="UI: ", func_name=0x0000000000000000, line_num=-1, eol=true, fmt="win_viewport") at log.c:150:20
    frame #3: 0x000000010039aea2 nvim`ui_call_win_viewport(grid=2, win=1000, topline=0, botline=1, curline=0, curcol=0, line_count=1) at ui_events_call.generated.h:321:3
    frame #4: 0x00000001003dfefc nvim`ui_ext_win_viewport(wp=0x0000000101816400) at window.c:939:5
    frame #5: 0x00000001003ec5b4 nvim`win_ui_flush at window.c:7303:7
    frame #6: 0x00000001003a04c0 nvim`ui_flush at ui.c:508:3
    frame neovim#7: 0x00000001002966ba nvim`do_os_system(argv=0x0000600000c0c000, input=0x0000000000000000, len=0, output=0x0000000000000000, nread=0x00007ff7bfefe830, silent=false, forward_output=false) at shell.c:894:3
    frame neovim#8: 0x0000000100295f68 nvim`os_call_shell(cmd="unset nonomatch; vimglob() { while [ $# -ge 1 ]; do echo \"$1\"; shift; done }; vimglob >/var/folders/gk/3tttv_md06987tlwpyp62jrw0000gn/T/nvimwwvwfD/0 ~foo", opts=kShellOptExpand | kShellOptSilent | kShellOptHideMess, extra_args=0x0000000000000000) at shell.c:663:18
    frame neovim#9: 0x0000000100295845 nvim`call_shell(cmd="unset nonomatch; vimglob() { while [ $# -ge 1 ]; do echo \"$1\"; shift; done }; vimglob >/var/folders/gk/3tttv_md06987tlwpyp62jrw0000gn/T/nvimwwvwfD/0 ~foo", opts=kShellOptExpand | kShellOptSilent | kShellOptHideMess, extra_shell_arg=0x0000000000000000) at shell.c:712:14
    frame neovim#10: 0x0000000100294c6f nvim`os_expand_wildcards(num_pat=1, pat=0x00007ff7bfefeb20, num_file=0x00007ff7bfefee58, file=0x00007ff7bfefee60, flags=43) at shell.c:328:7
    ...
    frame neovim#23: 0x000000010028ccef nvim`expand_env_esc(srcp=",~foo", dst="~foo", dstlen=4094, esc=false, one=false, prefix=0x0000000000000000) at env.c:673:17
    frame neovim#24: 0x000000010026fdd5 nvim`option_expand(opt_idx=29, val=",~foo") at option.c:1950:3
    frame neovim#25: 0x000000010026f129 nvim`set_init_1(clean_arg=false) at option.c:558:19
    frame neovim#26: 0x00000001001ea25e nvim`early_init(paramp=0x00007ff7bfeff5f0) at main.c:198:3
    frame neovim#27: 0x00000001001ea6bf nvim`main(argc=1, argv=0x00007ff7bfeff848) at main.c:255:3
justinmk added a commit that referenced this pull request May 28, 2022
@justinmk
fix(startup): crash on early logging
19dbc4f 
Problem:
22b52dd (neovim#11501) regressed 6f27f5e (neovim#10172), because
set_init_1..process_spawn tries to log (see backtrace below), but the
mutex isn't initalized yet. Even if the mutex were valid, we don't want
early logging to fallback to stderr because that can break embedders
when stdio is used as an RPC channel.

Solution:
- Skip logging if log_init wasn't called yet.
- FUTURE: when "remote TUI" is merged, can we remove log_lock()?

    frame #1: 0x00000001001d54f4 nvim`open_log_file at log.c:205:7
    frame #2: 0x00000001001d5390 nvim`logmsg(log_level=1, context="UI: ", func_name=0x0000000000000000, line_num=-1, eol=true, fmt="win_viewport") at log.c:150:20
    frame #3: 0x000000010039aea2 nvim`ui_call_win_viewport(grid=2, win=1000, topline=0, botline=1, curline=0, curcol=0, line_count=1) at ui_events_call.generated.h:321:3
    frame #4: 0x00000001003dfefc nvim`ui_ext_win_viewport(wp=0x0000000101816400) at window.c:939:5
    frame #5: 0x00000001003ec5b4 nvim`win_ui_flush at window.c:7303:7
    frame #6: 0x00000001003a04c0 nvim`ui_flush at ui.c:508:3
    frame neovim#7: 0x00000001002966ba nvim`do_os_system(argv=0x0000600000c0c000, input=0x0000000000000000, len=0, output=0x0000000000000000, nread=0x00007ff7bfefe830, silent=false, forward_output=false) at shell.c:894:3
    frame neovim#8: 0x0000000100295f68 nvim`os_call_shell(cmd="unset nonomatch; vimglob() { while [ $# -ge 1 ]; do echo \"$1\"; shift; done }; vimglob >/var/folders/gk/3tttv_md06987tlwpyp62jrw0000gn/T/nvimwwvwfD/0 ~foo", opts=kShellOptExpand | kShellOptSilent | kShellOptHideMess, extra_args=0x0000000000000000) at shell.c:663:18
    frame neovim#9: 0x0000000100295845 nvim`call_shell(cmd="unset nonomatch; vimglob() { while [ $# -ge 1 ]; do echo \"$1\"; shift; done }; vimglob >/var/folders/gk/3tttv_md06987tlwpyp62jrw0000gn/T/nvimwwvwfD/0 ~foo", opts=kShellOptExpand | kShellOptSilent | kShellOptHideMess, extra_shell_arg=0x0000000000000000) at shell.c:712:14
    frame neovim#10: 0x0000000100294c6f nvim`os_expand_wildcards(num_pat=1, pat=0x00007ff7bfefeb20, num_file=0x00007ff7bfefee58, file=0x00007ff7bfefee60, flags=43) at shell.c:328:7
    ...
    frame neovim#23: 0x000000010028ccef nvim`expand_env_esc(srcp=",~foo", dst="~foo", dstlen=4094, esc=false, one=false, prefix=0x0000000000000000) at env.c:673:17
    frame neovim#24: 0x000000010026fdd5 nvim`option_expand(opt_idx=29, val=",~foo") at option.c:1950:3
    frame neovim#25: 0x000000010026f129 nvim`set_init_1(clean_arg=false) at option.c:558:19
    frame neovim#26: 0x00000001001ea25e nvim`early_init(paramp=0x00007ff7bfeff5f0) at main.c:198:3
    frame neovim#27: 0x00000001001ea6bf nvim`main(argc=1, argv=0x00007ff7bfeff848) at main.c:255:3
justinmk added a commit that referenced this pull request May 29, 2022
@justinmk
fix(logging): skip recursion, fix crash
5852047 
Problem:
1. The main log routine does not protect itself against recursion.
   log_lock() doesn't guard against recursion, it would deadlock...
2. 22b52dd (neovim#11501) regressed 6f27f5e (neovim#10172), because
   set_init_1..process_spawn tries to log (see backtrace below), but the
   mutex isn't initalized yet. Even if the mutex were valid, we don't
   want early logging to fallback to stderr because that can break
   embedders when stdio is used as an RPC channel.

    frame #1: 0x00000001001d54f4 nvim`open_log_file at log.c:205:7
    frame #2: 0x00000001001d5390 nvim`logmsg(log_level=1, context="UI: ", func_name=0x0000000000000000, line_num=-1, eol=true, fmt="win_viewport") at log.c:150:20
    frame #3: 0x000000010039aea2 nvim`ui_call_win_viewport(grid=2, win=1000, topline=0, botline=1, curline=0, curcol=0, line_count=1) at ui_events_call.generated.h:321:3
    frame #4: 0x00000001003dfefc nvim`ui_ext_win_viewport(wp=0x0000000101816400) at window.c:939:5
    frame #5: 0x00000001003ec5b4 nvim`win_ui_flush at window.c:7303:7
    frame #6: 0x00000001003a04c0 nvim`ui_flush at ui.c:508:3
    frame neovim#7: 0x00000001002966ba nvim`do_os_system(argv=0x0000600000c0c000, input=0x0000000000000000, len=0, output=0x0000000000000000, nread=0x00007ff7bfefe830, silent=false, forward_output=false) at shell.c:894:3
    frame neovim#8: 0x0000000100295f68 nvim`os_call_shell(cmd="unset nonomatch; vimglob() { while [ $# -ge 1 ]; do echo \"$1\"; shift; done }; vimglob >/var/folders/gk/3tttv_md06987tlwpyp62jrw0000gn/T/nvimwwvwfD/0 ~foo", opts=kShellOptExpand | kShellOptSilent | kShellOptHideMess, extra_args=0x0000000000000000) at shell.c:663:18
    frame neovim#9: 0x0000000100295845 nvim`call_shell(cmd="unset nonomatch; vimglob() { while [ $# -ge 1 ]; do echo \"$1\"; shift; done }; vimglob >/var/folders/gk/3tttv_md06987tlwpyp62jrw0000gn/T/nvimwwvwfD/0 ~foo", opts=kShellOptExpand | kShellOptSilent | kShellOptHideMess, extra_shell_arg=0x0000000000000000) at shell.c:712:14
    frame neovim#10: 0x0000000100294c6f nvim`os_expand_wildcards(num_pat=1, pat=0x00007ff7bfefeb20, num_file=0x00007ff7bfefee58, file=0x00007ff7bfefee60, flags=43) at shell.c:328:7
    ...
    frame neovim#23: 0x000000010028ccef nvim`expand_env_esc(srcp=",~foo", dst="~foo", dstlen=4094, esc=false, one=false, prefix=0x0000000000000000) at env.c:673:17
    frame neovim#24: 0x000000010026fdd5 nvim`option_expand(opt_idx=29, val=",~foo") at option.c:1950:3
    frame neovim#25: 0x000000010026f129 nvim`set_init_1(clean_arg=false) at option.c:558:19
    frame neovim#26: 0x00000001001ea25e nvim`early_init(paramp=0x00007ff7bfeff5f0) at main.c:198:3
    frame neovim#27: 0x00000001001ea6bf nvim`main(argc=1, argv=0x00007ff7bfeff848) at main.c:255:3

Solution:
1. Check for recursion and log to stderr.
    - FUTURE: when "remote TUI" is merged, can we remove log_lock()?
2. Skip logging if log_init wasn't called yet.
justinmk pushed a commit that referenced this pull request Jul 15, 2022
@aktau
fix(tui): add fixups for hterm family neovim#19078
45ba2e1 
Problem
-------

In neovim#19040, I reported two things that started happening somewhen in the
last three months when using neovim in hterm (the Chrome Secure Shell
terminal):

 1. Under certain circumstances, the window title (set by nvim
    [i0]) would appear over the line I was typing, corrupting the screen.
 2. If I changed my $TERM from xterm-256color to the new hterm-256color
    (available since ncurses >=20210320), the window title corruption
    was gone, but pane scrolling was broken.

Both problems are due to changes in the termcap files, their source of
truth being the ncurses project. See "Timeline of ncurses changes" below
for details.

Cause: title corruption
-----------------------

The title corruption when using hterm + TERM=xterm-256color can be
explained by event #4 (ncurses 2022-03-12) in the ncurses timeline:

The xterm-256color termcap file gained status line termcodes in ncurses
2022-03-12. These termcodes are used by Neovim to set the title when.
hterm does not have a status line. Due to ncurses versions earlier than
2022-03-12 missing the xterm status line capability, Neovim manually
fixed up [t0] the terminfo file if $TERM was xterm-256color. So if
before Neovim manually added fsl/tsl capabilties, and after they were
in the termcap file, why did hterm suddenly start getting corruption?
The answer is that the termcodes for these capabilties are different
when Neovim fixes them up, versus the one in the new termcap database:

   fsl=\E[0$}                  // from xterm-256color
   tsl=\E[2$~\E[1$}\E[%i%p1%d` // from xterm-256color

   fsl=\x07                    // patched by Neovim
   tsl=\x1b]0;                 // patched by Neovim

hterm ignores the latter, but corrupts the screen with the former.

Solution: Make hterm users set hterm-256color, which lacks the new
fsl/tsl codes. Also, to reduce superfluous work, stop patching in this
capability when hterm is detected (even if hterm would ignore the
patched version).

Cause: pane corruption
----------------------

The pane corruption when using hterm + TERM=hterm-256color, but NOT when
using hterm + TERM=xterm-256color can be explained by:

 - Neovim uses DECSLRM when available [p1] for performant scrolling.
 - Both the hterm-256color and xterm-256color termcap databases
   advertise support for DECSLRM (ncurses timeline #1, #2 and #3).
 - hterm does not support DESCLRM [p2] (note: it does support DESCTBM for
   top/bottom scrolling, but it's broken [p3] and not used by Neovim)
 - xterm-alikes that are not real xterm generally don't support DECSLRM
   either, so Neovim patches it out [p4].

When using hterm-256color, hterm is no longer considered an xterm-alike
by Neovim. As a result, DECSLRM is not cleared. hterm does not support
it, so corruption ensues.

This is a problem with the hterm-256color termcap file, but we're stuck
with it so the best we can do is patch over it.

Timeline of ncurses changes
---------------------------

 1. 2019-05-19: Part of the DECSLRM capability (smglr AKA set_lr_margin)
    added to vt420+lrmm, which xterm-256color inherits [n1]
 2. 2021-03-20: hterm-256color added, inheriting xterm-256colors. [n2]
 3. 2021-09-25: The *parm versions of smglr (AKA set_lr_margin) were
    added to vt420+lrmm [n3]. Namely:
     1. smglp AKA set_left_margin_parm, and
     2. smgrp AKA set_right_margin_parm
 4. 2022-03-12: (new) codes for fsl, bsl and tsl added to xterm (add
    dec+sl to xterm-new, per patch neovim#371 -TD) [n4]

Fixes neovim#19040.

[i0]: https://github.com/neovim/neovim/blob/3a4fa22badc5595afc0a994ead965ff32ccf6c76/src/nvim/tui/tui.c#L1377
[t0]: https://github.com/neovim/neovim/blob/3a4fa22badc5595afc0a994ead965ff32ccf6c76/src/nvim/tui/tui.c#L1728,L1729
[p1]: https://github.com/neovim/neovim/blob/3a4fa22badc5595afc0a994ead965ff32ccf6c76/src/nvim/tui/tui.c#L1196
[p2]: https://bugs.chromium.org/p/chromium/issues/detail?id=1175065&q=component%3APlatform%3EApps%3EDefault%3EHterm
[p3]: https://bugs.chromium.org/p/chromium/issues/detail?id=1298796&q=component%3APlatform%3EApps%3EDefault%3EHterm
[p4]: https://github.com/neovim/neovim/blob/3a4fa22badc5595afc0a994ead965ff32ccf6c76/src/nvim/tui/tui.c#L1740-L1752
[n1]: mirror/ncurses@8f6d94b#diff-01544c577762d3308a1d232aa7afc79acf64b9a5057f88a004df82fda89549b7R2742
[n2]: mirror/ncurses@c265010#diff-01544c577762d3308a1d232aa7afc79acf64b9a5057f88a004df82fda89549b7R5907
[n3]: mirror/ncurses@f6b436c#diff-01544c577762d3308a1d232aa7afc79acf64b9a5057f88a004df82fda89549b7R2842
[n4]: mirror/ncurses@8bf8c83#diff-01544c577762d3308a1d232aa7afc79acf64b9a5057f88a004df82fda89549b7R4828

Signed-off-by: Nicolas Hillegeer <nicolas@hillegeer.com>
justinmk pushed a commit that referenced this pull request Apr 21, 2023
@cryptomilk
fix(usercmd): Fix buffer overflow in uc_list() (neovim#23225)
9e79f74 
fix(usercmd): fix buffer overflow in uc_list()

Build with: -Wp,-D_FORTIFY_SOURCE=3 -O1 and gcc 13.

*** buffer overflow detected ***: terminated

(gdb) bt
  #0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
  #1  0x00007f3eb8b93c03 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
  #2  0x00007f3eb8b42aee in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
  #3  0x00007f3eb8b2b87f in __GI_abort () at abort.c:79
  #4  0x00007f3eb8b2c60f in __libc_message (fmt=fmt@entry=0x7f3eb8ca72e6 "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:150
  #5  0x00007f3eb8c27b29 in __GI___fortify_fail (msg=msg@entry=0x7f3eb8ca728c "buffer overflow detected") at fortify_fail.c:24
  #6  0x00007f3eb8c26364 in __GI___chk_fail () at chk_fail.c:28
  neovim#7  0x00007f3eb8c25f45 in ___snprintf_chk (s=s@entry=0x55b8c7c096a5 <IObuff+5> "t' item", maxlen=maxlen@entry=1025, flag=flag@entry=2, slen=slen@entry=1020, format=format@entry=0x55b8c7b872a6 "%ldc") at snprintf_chk.c:29
  neovim#8  0x000055b8c7aea59f in snprintf (__fmt=0x55b8c7b872a6 "%ldc", __n=1025, __s=0x55b8c7c096a5 <IObuff+5> "t' item") at /usr/include/bits/stdio2.h:54
  neovim#9  uc_list (name=name@entry=0x55b8c8351788 "Explore", name_len=name_len@entry=7) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/usercmd.c:534
  neovim#10 0x000055b8c7aeb8a0 in ex_command (eap=0x7fffdc350e60) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/usercmd.c:1009
  neovim#11 0x000055b8c7972537 in execute_cmd0 (retv=retv@entry=0x7fffdc350e54, eap=eap@entry=0x7fffdc350e60, errormsg=errormsg@entry=0x7fffdc350e58, preview=preview@entry=false) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:1620
  neovim#12 0x000055b8c7975c55 in do_one_cmd (cmdlinep=cmdlinep@entry=0x7fffdc3510b8, flags=flags@entry=0, cstack=cstack@entry=0x7fffdc351140, fgetline=fgetline@entry=0x55b8c79882b8 <getexline>, cookie=cookie@entry=0x0) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:2279
  neovim#13 0x000055b8c79767fe in do_cmdline (cmdline=<optimized out>, fgetline=0x55b8c79882b8 <getexline>, cookie=0x0, flags=0) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:578
  neovim#14 0x000055b8c7a17463 in nv_colon (cap=0x7fffdc351780) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:3228
  neovim#15 0x000055b8c7a11b35 in normal_execute (state=0x7fffdc351700, key=<optimized out>) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:1196
  neovim#16 0x000055b8c7ab0994 in state_enter (s=0x7fffdc351700) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/state.c:99
  neovim#17 0x000055b8c7a0ef68 in normal_enter (cmdwin=false, noexmode=false) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:497
  neovim#18 0x000055b8c78a0640 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/main.c:641
justinmk pushed a commit that referenced this pull request Nov 14, 2023
@cryptomilk @zeertzjq
fix(usercmd): fix buffer overflow in uc_list()
30cfd28 
Build with: -Wp,-D_FORTIFY_SOURCE=3 -O1 and gcc 13.

*** buffer overflow detected ***: terminated

(gdb) bt
  #0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
  #1  0x00007f3eb8b93c03 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
  #2  0x00007f3eb8b42aee in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
  #3  0x00007f3eb8b2b87f in __GI_abort () at abort.c:79
  #4  0x00007f3eb8b2c60f in __libc_message (fmt=fmt@entry=0x7f3eb8ca72e6 "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:150
  #5  0x00007f3eb8c27b29 in __GI___fortify_fail (msg=msg@entry=0x7f3eb8ca728c "buffer overflow detected") at fortify_fail.c:24
  #6  0x00007f3eb8c26364 in __GI___chk_fail () at chk_fail.c:28
  neovim#7  0x00007f3eb8c25f45 in ___snprintf_chk (s=s@entry=0x55b8c7c096a5 <IObuff+5> "t' item", maxlen=maxlen@entry=1025, flag=flag@entry=2, slen=slen@entry=1020, format=format@entry=0x55b8c7b872a6 "%ldc") at snprintf_chk.c:29
  neovim#8  0x000055b8c7aea59f in snprintf (__fmt=0x55b8c7b872a6 "%ldc", __n=1025, __s=0x55b8c7c096a5 <IObuff+5> "t' item") at /usr/include/bits/stdio2.h:54
  neovim#9  uc_list (name=name@entry=0x55b8c8351788 "Explore", name_len=name_len@entry=7) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/usercmd.c:534
  neovim#10 0x000055b8c7aeb8a0 in ex_command (eap=0x7fffdc350e60) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/usercmd.c:1009
  neovim#11 0x000055b8c7972537 in execute_cmd0 (retv=retv@entry=0x7fffdc350e54, eap=eap@entry=0x7fffdc350e60, errormsg=errormsg@entry=0x7fffdc350e58, preview=preview@entry=false) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:1620
  neovim#12 0x000055b8c7975c55 in do_one_cmd (cmdlinep=cmdlinep@entry=0x7fffdc3510b8, flags=flags@entry=0, cstack=cstack@entry=0x7fffdc351140, fgetline=fgetline@entry=0x55b8c79882b8 <getexline>, cookie=cookie@entry=0x0) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:2279
  neovim#13 0x000055b8c79767fe in do_cmdline (cmdline=<optimized out>, fgetline=0x55b8c79882b8 <getexline>, cookie=0x0, flags=0) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:578
  neovim#14 0x000055b8c7a17463 in nv_colon (cap=0x7fffdc351780) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:3228
  neovim#15 0x000055b8c7a11b35 in normal_execute (state=0x7fffdc351700, key=<optimized out>) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:1196
  neovim#16 0x000055b8c7ab0994 in state_enter (s=0x7fffdc351700) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/state.c:99
  neovim#17 0x000055b8c7a0ef68 in normal_enter (cmdwin=false, noexmode=false) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:497
  neovim#18 0x000055b8c78a0640 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/main.c:641
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
2 participants
@norcalli @justinmk